Tokens

​

Lifecycle

1. /v1/verify returns { token, token_id, authorized: true, expires_in: 60 }
2. Client passes token to your backend (via header, not URL)
3. Backend calls /v1/token/{token_id}/validate?token={jwt} server-side
4. { valid: true, expires_in: 44 } → proceed; { valid: false } → reject

​

Security properties

• 60-second TTL — short window limits replay exposure
• Never store tokens — they are single-use credentials, not session keys
• Validate server-side — do not trust the client’s authorized flag for high-value actions
• No PII in the JWT — the token identifies the transaction, not the speaker

​

Passing tokens safely

// Good — header auth
await fetch("/api/payment", {
  headers: { "X-VoiceMark-Token": verify.token },
});

// Bad — never put tokens in URLs
await fetch(`/api/payment?token=${verify.token}`); // logs, caches, referer headers